Linux Defense Evasion Techniques Detected by AhnLab EDR (1)

This report describes Linux defense-evasion techniques observed in the wild — including disabling host firewalls (iptables, UFW, firewalld), deactivating Linux Security Modules (AppArmor/SELinux), and deploying kernel/user-mode rootkits (Diamorphine, Reptile) — with examples such as the Kinsing coinminer and the Watchdog group; it explains how AhnLab EDR detects these behaviors and helps administrators respond.